Mike Nash

Reducing latency from 2 Seconds to the time it takes to blink. Last week Meritalk released an article on DISA's plan to roll Thunderdome out to 60 sites through FY2024.  You may ask why this is important?  Why should anyone care? This matters because Thunderdome is likely to be one of the most impactful cybersecurity programs in DoD history.  All while America’s adversaries are the most aggressive they’ve ever been.  Why does Thunderdome matter? Through Thunderdome, the DOD is significantly increasing security, lowering costs, and massively improving the user experience all at the same time.  The perfect trifecta.  Imagine being a user and waiting for web response times in excess of 2 seconds. It's 2024, Thunderdome fixes this, globally. Direct benefits: -Direct Access to the NIPRnet from anywhere in the world -Users access SaaS services directly through the service connections, bypassing the JRSS stacks -Improves existing remote access latency from 2s to <10ms -Provides full ZTNA capabilities (conditional access) and full continuous monitoring of all traffic, users, and devices -Aligns on premises ZT policies with remote users This matters and brings DoD connectivity into more modern times while increasing conditional based access and security. It's faster, less expensive, and more secure. https://lnkd.in/eDp3ykX7 #meritalk #disa #CISO #ZT #zerotrust #DoD #defensedepartment

206

7 Comments

Vendor Provided Containers - Part 4 The "Vendor Dependency Conundrum". So you do FedRAMP or DOD/IL* work and you have a POAM (Plan of Action and Milestones). For the folks who don't do Public Sector work, this is basically a list of all of your compliance violations and vulnerabilities. What happens when you have a vulnerability in a vendor provided container? Specifically for something the vendor doesn't produce or patch? Often companies will make this a "Vendor Dependency". A "Vendor Dependency" is basically saying, "we'll wait until the upstream vendor patches it". But lets be real for a moment. The choice to use the "Vendor Provided Container" is yours and yours alone. Making it a vendor dependency is passing the responsibility for something that is most definitely the responsibility of the Cloud Service Provider (the authorized service). I described in my previous posts how vendor provided containers are woefully inadequate for production use (not hardened, not stripped, missing FIPS, etc). Long story short, the burden is still on the Cloud Service Provider (or consumer of those containers) to do all of the above. So while vendor provided containers are good to get started, they shouldn't be anywhere near a production environment. Going forward we need vendors to move past creating "development" containers, because that's really all they're good for. We need a standard for containers coming from vendors and if vendors are truly pursuing their CISA pledge of Secure by Design, they would harden them and strip them according to best practices. If they want to make it easy for DOD/FedRAMP customers, they would STIG harden them, and provide them with valid FIPS libraries. In summary, don't use vendor provided containers. You need to build your own or work with a vendor that builds and hardens container images as a service. Building your own images has a real cost to it too. It's also a discipline to do it fast and do it well. Teams are not usually equipped to take this on and often haphazardly do this work.

19

“Cost-minus contracting” is not a thing. Fixed Price Incentive-Firm Target (FPIF) contracts, however, have been around for a while. DoD goes through a cycle of Cost Plus and Fixed Price contracting. When costs seem to grow, DoD goes FP, shifting cost risk to contractors ever since the Air Force’s “Total Package Procurement” movement in the 1950s. When time to field capabilities grows and quality of capability declines (as has been the historical consequence of FP contracting), DoD assumes some cost risk back and welcomes CP to the fold again. In contracting, incentives are king. If we are shifting back to more FPIF contracts - especially for software development - DoD must be able to effectively manage product quality, time to deployment, and time to update/refresh. They also must understand and be able to scale the OTA lifecycle, from pilot to production to major program (if necessary). All of this is hard and involves risk…where to place that risk has been a cyclical question for DoD contracting since the Commission on Government Procurement. Rather than picking industry partners who say the rights things, DoD must focus on those who deliver outcomes and results. Industry partners must be honest and transparent with government - qualities that require more incentive for some - to prove that delivering those outcomes and results to the end user really is the highest goal instead of maximizing profit at their expense. In short: we don’t need Contracting Ad Libs. We need Effective Incentive Managament and Transparency in Contracting. #defensereform #contracting #nationalsecurity #defenseindustry #innovation #procurement #CP #FPIF

4

The DoD Inaugural Human-Machine Interfaces CTA now has an approved Roadmap and Vision & Strategy document. They can be found here (CAC enabled). https://lnkd.in/eZU2kZan For those without a CAC, request via the DoD CTO Website, Critical Technologies page (at the bottom). https://lnkd.in/eey4y2BP There are too many Stakeholders across our Department, Industry, Partner Nations and Academia to thank for their support in 2024 to help refine, scope, prioritize and deliver this as a collaborative Strategy. We had over 300 Stakeholder engagements, 5 deliberate HMI CTA Workshops and numerous Key Leader Engagements to get this right. We will continue to refine with our Ecosystem as we drive to accelerate these technologies and set the conditions across the Department for a persistent and endemic focus on these Critical Technologies in our primary Mission Focus Areas. 2024 was great, but now the real work begins. Get Ready.

267

18 Comments

DoD DIGITAL ENGINEERING I love it when DoD leadership steps out in front of the media and so clearly articulates the INTENT and VALUE of Digital Engineering approaches. Col Matt Strohmeyer nailed it. CUSTOM COMMON OPERATING PICTURE (COP) VIEWS FOR EVERY MISSION/LEADER "Instead of a single, standardized, god’s-eye-view, Col. Matthew Strohmeyer said Monday, the goal of GIDE is a constantly evolving ecoystem of different applications, analytics, and interfaces, customized to different users at every level, from four-star theater commanders to mid-grade staffer officers to junior leaders on the battlefield, that will all draw — in different ways — on the same vast pool of data, shared across the different armed services worldwide." POWER OF CLOUD COMPUTE CUSTOM COP SERVICES “the goal is not necessarily to create that one COP that can see essentially everything we have … one Common Operating Picture to rule them all,” the colonel continued. “We need to have a heterogeneous mix of mission applications to get after all the things that we are doing.” Digital Engineering Ecosystems should be typified by numerous vendors being present in an environment that is both collaborative and competitive. Each brings their People, Process, Technology mojo so the government can have access to the right tool for the right purpose. One size does not fit all and there is more than enough work for all of us to do. We're better together. OPEN-SPEC APIs TO LINK DATA & COP CAPABILITIES "Instead of a single super-standard for all data, Strohmeyer suggested, a more practical solution might be mandating Application Programming Interfaces (APIs) that automatically translate between otherwise incompatible systems. In fact, before an organization is allowed to “play” in the GIDE experiments, he said, they must provide “open and common access to data,” whether through an API or another automatic translation tool." See my post 2 days ago on this topic: https://lnkd.in/gahF6KQj AGILE APPROACHES "Adaptability requires rapid feedback from a wide range of users, so Strohmeyer’s team has accelerated their already blistering pace, adding smaller weekly workshops to their ambitious quarterly experiments" "In fact, part of the GIDE philosophy — inspired more by Silicon Valley startups than Washington bureaucracy — is an eagerness to “fail fast.” Sometimes known as “agile” development or DevSecOps, the basic strategy is to put nascent tech in the hands of real users, let them test it until something breaks, fix it quickly, and then let the users test the updated iteration until that breaks too." https://lnkd.in/g2HTRWuu

2

Like most policy, the desired outcomes are seldom those to which we arrive, calling my shot: Step 1. Demand source code from contractor that I don’t know what to do with Step 2. Share it through one of many nightmarish repos with other government entities who also have no idea what to do with it Step 3. Hand code off to “software factory” staffed with prime contracted 0.5x developer drones Step 4. Prime suddenly drops a “proprietary” product that looks a lot like a bootlegged knock off but was “developed under IRAD” Step 5. Buy what was free, with an added VAR tax https://lnkd.in/eqv-62Dx

47

14 Comments

SolarWinds GVP of Engineering Krishna Sai explores how AI, ML, and observability can help SOCOM and other DoD agencies achieve a multi-domain infrastructure that is interoperable, dependable, transparent, secure, and high performing. Read more in C4ISRNET here:

8

A good friend reached out to me last week, frustrated with his search for contract work. He's an outstanding, super-smart full-stack engineer with experience working on mission-critical projects for a Fortune 500 defense contractor. He's incredibly talented. However, contract recruiters keep focusing on his years of experience—irrelevant stuff! From my perspective, I'm not interested in someone who has been writing the same C++ or C# code for 5+ years. It often indicates they've been pigeonholed, and there may be a good reason for that! I'm MUCH more interested in specific skills and skill levels, something we are very passionate about at Skills Base. Despite significant advancements in skills assessment and management, many organizations still struggle with adopting a skills-based approach, especially in talent acquisition. This is a challenge we’re committed to solving.

20

2 Comments

Read how the application of mission engineering to civilian organizations is critical to building resilience as well as key to matching the right assets to achieve the organizational objectives. https://lnkd.in/epR6Fbu3

1

Great overview of DoD flowdowns and a link to a detailed white paper for identification of CDI/CUI in contracts.

6

Check out this article and let me know if game changing AI is in your roadmap

17

Last week, I mentioned that the US Army was going to require SBOMs for both COTS and contractor software. Here are the details you need - the timeline is short, and in my opinion this is a significant memo for anyone working with the Army! This memo is tied back to EO 14028, the NIST SSDF, OMB M-23-16, OMB M-22-18, and Army Directive 2024-02. These are the same publications I've found highly valuable the past few years. What's in scope? This memo applies to any computer software developed exclusively with Government funds to include any of the following: 1. Government-off-the-Shelf software 2. Computer software developed by a Contractor using exclusively Contractor funds or Independent Research and Development funds 3. Commercial computer software (as defined by FAR 2.101) 4. Noncommercial computer software developed and delivered to the Government by a Contractor Commercial computer software includes Commercially off-the-shelf (COTS) software and open source software. It does NOT include cloud services at this time. Contract language will now require vendors to: 1. Generate and deliver SBOMs 2. Include associated license rights According to Page 2, item b, PEOs/PM's will collect, store and manage SBOMs. Then, SBOMs will be monitored and used for vulnerability, incident management, and supply chain risk management. - this is a big one for dynamic management of SBOM, and I'm thrilled to see this verbiage. Key deliverables are only 90 days out! Within 90 days (Dec 2024): - Sample SBOM language for contracts will be in place - SBOM working group will be established - Subcontractors will be notified of SBOM language - SBOM management process will be codified - Risk and incident management processes will be codified for continuous monitoring of SBOMs Starting essentially January 1, 2025: - SBOMs will be collected and analyzed for all software in use - Risk and incident management activities will be executed The 6 page memo can be found here: https://lnkd.in/gkyRTZaq Sound difficult? GitLab can definitely help - don't hesitate to reach out. #sbom #dod #usarmy #gitlab

33

13 Comments

Sharing this great article by my Intel Corporation colleague, Burnie Legette, on the growing use of Digital Twins, specifically in government critical infrastructure. This is just one of many articles I've shared in the past year on the growing adoption of digital twins and the recognition of their increasing value across a range of markets and applications.  Adding AI makes digital twins even more powerful. They can automatically find solutions, streamline operations, and predict future needs. This technology supports essential operations with better performance, accuracy, and scalability. With 63% of federal agencies already investing or planning to invest in digital twins, the future of government infrastructure looks bright. https://lnkd.in/gDZNJ_du

28

Everyone is jumping on the SBOM train these days. We like to say "you have an SBOM, now what?" If you're reading this and want to know how to *actually* operationalize your SBOM (not just plugging it in and getting a few related CVEs), let me give you a demo of Bulletproof Trust (30m or less, I'll give you something to think about). Our C-SCRM tool zeroes you in on the things YOU care about in your supply chain risk management strategy, kicking out false positives, and giving you a mechanism to track, trace, audit, and report on your C-SCRM process.

1

Air Force Boosts Space Command with $20M Data-as-a-Service Deal to Palantir Palantir wins a $20M contract to deliver a data-as-a-service platform supporting Space Command, with completion set for June 2025. https://lnkd.in/g4_NBNbE

40

1 Comment

Federal Budget IQ features guest contributor Peter V., this week, discussing DOD investments in tech and the importance of integration. The FY25 budget request includes "$21.1 billion for Command, Control, Communications, Computers, and Intelligence (C4I) Systems, 7% of the investment budget request and a $6.6 billion increase from the FY24 request." #defense #defence #defensetech #defensebudget #defenseindustry #defensecontracting #cloud #artificialintelligence, #informationtechnology #datastorage #datamanagement #dataintegration #contestedlogistics, #modelingandsimulation #hasc #sasc #ndaa But despite big investments, the "convergence and seamless employment of such enabling digital technologies remains a significant challenge. DOD’s goal of deploying a, “modernized, information network that is a dynamic and agile” with “lower latency, and greater network capacity,” remains a nascent and fragile work in progress." Villano goes on to highlight some specifics from House and Senate versions of the FY25 NDAA, with a focus on emerging tech and contested logistics. Details include guidance on the Agility Prime Transition Working Group, a pilot program on Army readiness in contested logistics environments, High Performance ComputeTechnologies and Integrated Surveillance System Joint Cross-Domain Exchange. https://lnkd.in/ejz4ePFs

8

1 Comment